Elasticsearch string query url with PHP and cURL

Elastic Stack Elasticsearch
1

I am using elasticsearch to get some kind of information about my users.

I just made a script in PHP that parses a document by using cURL and it is sending requests like:

http://something.something/test*/_search?q=%2Blogin:"jack"%20%2Bdate:"*May%20%20%201"%20%2Broom:"nameOfRoom"&default_operator=AND&size=99999999

Which, decoded, is:

http://something.something/test*/_search?q=+login:"jack" +date:"*May 1" +room:"nameOfRoom"&default_operator=AND&size=99999999

Instead of getting records about Jack from May 1st (yeah there is triple space) that was in the "nameOfRoom" room I am getting stuff from whole May with logins like "--jack" "*jack" etc.
Can someone provide info how to build more complicated query like this?
Regards Tom

2

did you try with PHP url urldecode & urlencode.

3

Thanks for the response. Yeah I've tried in that way but it keep showing me too much records (like --jack, *jack and wrong dates [from May but not only from 1st) :frowning:

4

It's likely an analyzer problem, not a PHP encoding problem. Your date field looks to be a string, not an actual Date. That means when you search for May 1, it is actually tokenized into ["may", "1"]. So any document that has the term "may" will match.

If you haven't specified a mapping yourself, you'll need to read up on Mappings and Analyzers, configure the date field to be a real Date, then use a Range filter/query to check the date.

Also, I'd recommend using the Query DSL instead of q= params, it is a lot more flexible. And there's also [an official PHP client][1], which can make life easier :slight_smile:
[1]: https://github.com/elastic/elasticsearch-php/